OneDroid

Docs

Connect an agent
in one command.

OneDroid Synapse is a governed MCP gateway: your agents connect to one URL, and every tool call is authenticated, policy-checked and written to an audit log you own. This page gets Claude Code talking to it.

Getting started

Sign in, choose where your data lives, create a hub.

Onboarding is two screens. Only the first carries any weight.

1. Sign in

Go to synapse.onedroid.ai and click Sign in. Three options: Google, Microsoft, or an email address. First time here, use Sign up instead.

Use the same method every time. Sign-in is handled by Clerk, and signing in with Google when you originally signed up with Microsoft creates a separate account — even with the identical email address. If you end up signed in with no hub, or the wrong one, this is almost always why.

2. Choose where your data is stored

Both options are fully supported. Pick based on whether you need to own the database. You can change it later under Manage → Database.

OneDroid Managed

One click, nothing to configure. Tables are created on OneDroid's infrastructure. Best for getting started, evaluating, and teams with no data-residency constraint.

Bring your own database

Paste a connection string and password. Every table is created in your database — Supabase, Neon, or any PostgreSQL 15+. If you stop using OneDroid, the data simply stays where it already was.

The one mistake everybody makes. Leave the literal [YOUR-PASSWORD] placeholder in the connection string exactly as it appears. Do not substitute your real password. OneDroid Synapse splices the password in from the separate field at connection time, which is why it is never stored in the URI. Pasting the real password into the string is the single most common failure in this flow, and it presents as "credentials look right but TEST CONNECTION fails".

From Supabase, take Connect → Transaction pooler → URI, not the direct connection. Click Test connection and wait for it to succeed before clicking Next — a bad string then surfaces here rather than after your hub exists.

3. Create your hub

A hub is your workspace: it holds your connections, your team and your permissions. Give it a name and click Create hub.

Your slug will not be what you typed. OneDroid Synapse appends a short unique suffix, so team-dev-1 becomes something like team-dev-1-dj8p87. Take the real slug from the browser URL or the Hub Details panel before you bookmark or share a link.

4. Find your way around

You land on the dashboard. A fresh hub shows 1 member, 1 group and zero connections — that is expected, not a failure. The left nav splits four ways: Overview (status and the getting-started checklist), Connect (connections, AI clients, tools, packs), Manage (members, groups, API tokens, database), and Admin (tool toggles, sharing, invites, activity logs, reporting).

If the connections count stays at zero, an admin has to enable upstream services first under Connect → Connections — members cannot add their own. Once a connection is enabled, each member supplies their own token or OAuth login for it.

Pick your path

Connecting an agent.

Claude Code, CI, or any HTTP client

Use a personal access token and one bearer header. No install, no tunnel, no device-code flow. Start below.

Claude Desktop / Claude.ai web

Connect through an OAuth custom connector in the browser — no token to manage. Ask us for the walkthrough.

Remote tunnels, SSH, containers

If you need state that survives a reconnect, or multi-session token locking, use the tunnel binary with the device-code flow instead of a token. Ask us.

Quickstart

Claude Code, via a personal access token.

1. Create a token

Sign in at synapse.onedroid.ai. Check the hub picker in the top-left is on the hub you want — tokens are bound to one hub and one user, so this choice matters. Then go to Manage → API Tokens and click Create token.

Give it a name you'll recognise later (claude-code-laptop, ci-nightly) and an expiry. Prefer a bounded lifetime for anything that isn't on a rotation schedule.

Copy the token before dismissing the dialog. The plaintext is shown once. If you lose it you can Reveal it later from the tokens table, or Rotate to issue a new one — but don't rely on that mid-setup.

2. Add it to Claude Code

claude mcp add \
  --transport http \
  "synapse" \
  https://synapse.onedroid.ai/agent/mcp \
  --header "Authorization: Bearer syn_YOUR_TOKEN"

The label synapse is arbitrary. The URL is not — see the note below.

3. Reload, then confirm

MCP servers load at startup, so if you ran that inside a running session, reload the window or open a new one. Then:

claude mcp list
# synapse: https://synapse.onedroid.ai/agent/mcp (HTTP) - ✓ Connected

Or type /mcp in an interactive session — you should see the synapse entry listing the tools your hub exposes.

4. Prove it works before wiring anything else

This returns HTTP 200 with a JSON-RPC result when the token is good, 401 {"code":"invalid_token"} when it's wrong, and 401 {"code":"missing_token"} when the header didn't arrive:

curl -s https://synapse.onedroid.ai/agent/mcp \
  -H "Authorization: Bearer syn_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
       "params":{"protocolVersion":"2025-06-18","capabilities":{},
                 "clientInfo":{"name":"probe","version":"1.0"}}}'

The one URL detail worth reading

Use /agent/mcp. No hub slug.

A token is bound to a hub when you create it, so https://synapse.onedroid.ai/agent/mcp resolves that hub server-side — you never type a slug.

/hub/<slug>/mcp is a different route, used by OAuth clients where the slug in the path selects the hub. A token can reach it, but only if the slug matches the hub the token was bound to; a mismatch returns ERR_SCOPE_UNAVAILABLE. There is no reason to prefer it for a token client.

Tokens

What a token is, and isn't.

Scope

One user, one hub. Create a separate token per hub you need to reach. Five per user per hub.

Permissions

A token inherits your current role in its hub. It does not freeze your permissions at creation time — downgrade the role and the token loses that access immediately, with nothing to re-issue.

Custody

Stored as a hash plus an encrypted copy so Reveal can work. Rotate invalidates the old token and keeps the remaining lifetime; Revoke kills it with no replacement.

Treat it like a password: password manager or secret store, never chat, git, or a shared doc. If one leaks, Revoke is immediate.

Troubleshooting

The failures people actually hit.

401 missing_token

The header isn't being sent. Check with claude mcp get <name> and look for the Headers block.

401 invalid_token

Typo, or the token was rotated or revoked. Reveal it from the tokens page and compare, or rotate and reconfigure.

ERR_SCOPE_UNAVAILABLE

You're calling /hub/<slug>/mcp with a slug that doesn't match the token's hub. Switch to /agent/mcp.

✗ Failed to connect

Run the curl probe first. If curl returns 200 but Claude Code doesn't, it's a header mismatch in the client config, not the token.

A tool says "workspace not found"

Auth is fine — the hub hasn't connected that upstream yet. Add it under Connect → Connections. Authentication and upstream connections are separate things.

404 deep-linking to a settings page

The dashboard uses hash-based routing, so a settings URL pasted into a fresh tab won't resolve. Start at the root and navigate from the sidebar.

Something here wrong or missing?

Tell us and we'll fix the page — michal@onedroid.ai. You'll reach the person who wrote the code. We reply within one business day.